Privacy Policy

BrightBroom (Pty) Ltd, registration number 2020/440020/07, trading as ZapZuba ("ZapZuba", "we"), is responsible for your personal information under the Protection of Personal Information Act, 2013 (POPIA). Our Information Officer is Thando Somacele.

This policy covers everyone whose information we handle: customers who book deliveries, the people they nominate to hand over or receive a vehicle, drivers and driver applicants, dealers who list vehicles in our showroom, people who send showroom enquiries or contact us, and visitors to our website.

At each pickup and delivery, the nominated person types their PIN on the driver's phone, and our driver photographs the outside of the vehicle and its dashboard (odometer, fuel and warning lights), asks the nominated person to sign on the driver's phone, and records the location of the handover once. If the driver reports a problem at a handover, such as the nominated person not being there, the phone records its location once as evidence. Where there is no mobile signal, the record is kept on the driver's phone and sent to us when it reconnects. We ask drivers to photograph the vehicle, not people.

If you give us information about someone else, such as a nominated contact, please make sure they know you are sharing it with us and why.

ID and passport numbers are especially sensitive, so we limit who can see them (see section 7). The signature drawn at a handover is a picture of a signature, not a biometric record. We do not collect fingerprints or face scans.

We may ask drivers for a criminal background check where the law or a trip requires it. We only do this with the driver's consent, which they give when they apply.

• To provide the delivery you booked: quoting, payment, assigning a driver, the PIN handover and keeping you informed. (Performing our contract with you.)
• To verify customers and drivers and keep vehicles safe from fraud and theft. (Our legitimate interest and yours, and our contract.)
• To pay drivers and keep financial records. (Contract and legal obligations, including tax law.)
• To handle damage claims, complaints and disputes, including sharing trip records with you and your insurer. (Legitimate interest.)
• To pass showroom enquiries to dealers, and to answer messages you send us. (Your request.)
• To secure our website, prevent abuse and improve our service. (Our legitimate interest; analytics only with your consent.)

• The driver assigned to a trip sees the customer's name and phone number, the addresses and access notes, the vehicle details, and the nominated contacts. Drivers never see the handover PINs.
• Customers see their assigned driver's name and phone number.
• Dealers receive the showroom enquiries sent to them.
• Your insurer (and ours, once we have one) when there is a claim.
• Border, customs and police officials, as needed for a cross-border trip or when the law requires.
• Our professional advisers, and a buyer of our business if that ever happens, under confidentiality.

Our website, database, document and photo storage, and the tools that automate our notifications run on servers we rent in South Africa. The companies that provide those servers and our other services (POPIA calls them operators) process information for us under contract:

We do not sell personal information.

We keep your account, trip, verification and payment records, documents and handover photos in South Africa. A few providers are outside South Africa: Resend (the emails we send you), Google Maps Platform (addresses you type and the route between them) and, only if you accept analytics cookies, PostHog.

We only use providers that are bound by law, binding corporate rules or an agreement to protect personal information to a standard similar to POPIA, as section 72 of POPIA requires.

On a cross-border trip, the details needed to take the vehicle across the border, such as the driver's passport and the vehicle's papers, are disclosed to that country's officials.

• Information travels over encrypted connections.
• Identity documents, licences, permits, handover photos and signatures are kept in private storage that is never open to the internet. Our website only shows a file after checking who is asking: the person it belongs to, the customer and the assigned driver for a trip's handover records, or our verification team.
• Drivers' profile photos are the exception: they are served without a sign-in, so anyone with the link can open one.
• Passwords are stored as secure hashes, never as text.
• Staff access is limited to what each role needs.

If a breach puts your information at risk, we will tell you and the Information Regulator as POPIA requires.

After that we delete the information or remove anything that identifies you, unless the law requires us to keep it longer.

We also use your browser's local storage, which stays on your device. While you fill in a booking, our booking page (/book) saves the unfinished booking under trip_draft, including the addresses, the vehicle's registration and the nominated contacts' names and phone numbers, so it survives a refresh or signing in. It is removed when you submit the booking. Your cookie choice is stored the same way, under cookie_consent_status, and PostHog keeps a copy of it so it can respect your choice.

Analytics never run unless you accept them, and you can change your mind at any time on the cookie preferences page.

We only send marketing messages if you have agreed to them or, as POPIA allows, about similar services if you are already a customer. Every marketing message lets you opt out. Messages about your bookings are not marketing and will still be sent.

• Ask what personal information we hold about you, and for a copy.
• Ask us to correct information that is wrong or out of date.
• Ask us to delete information we no longer need or are not entitled to keep.
• Object to our use of your information, and withdraw a consent you gave.
• Complain to the Information Regulator: POPIAComplaints@inforegulator.org.za, 010 023 5200 or 0800 017 160, Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 (inforegulator.org.za).

To make a request, email us at support@zapzuba.com. We may need to confirm your identity first. We respond within [days to respond to a privacy request]. Our PAIA manual is available at https://zapzuba.com/paia.

Our service is for people aged 18 and over. We do not knowingly collect information about children.

We may update this policy. The date at the top shows the latest version, and we will tell you of important changes by email.

Company

BrightBroom (Pty) Ltd, registration number 2020/440020/07

Directors

Thando Somacele, Sharon Somacele

Address

0B Cedar Avenue West, Fourways, Randburg, 2191

Email

support@zapzuba.com

Phone / WhatsApp

+27 72 225 1491

Information Officer

Thando Somacele

Deputy Information Officer

Sharon Somacele